Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 04:12

General

  • Target

    e289115d68f8af08e31a13598141a4b97823696686eb03ab2c19671f10d4c527.exe

  • Size

    100KB

  • MD5

    b0c39f43c1fdab9148941afe25c87aa0

  • SHA1

    585c91cc7f1aa6320c7ce93850e3b143fc027322

  • SHA256

    e289115d68f8af08e31a13598141a4b97823696686eb03ab2c19671f10d4c527

  • SHA512

    d7d2a166fa96f03ba67f7bcc33d93f28e75a6687e4c00258f1e840c824274f3b93f262da502794a3f15a7841d2cadaac88e44160dc487c352196a77b5c7054f6

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0Kj:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0Kj

Score
9/10

Malware Config

Signatures

  • Renames multiple (4827) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e289115d68f8af08e31a13598141a4b97823696686eb03ab2c19671f10d4c527.exe
    "C:\Users\Admin\AppData\Local\Temp\e289115d68f8af08e31a13598141a4b97823696686eb03ab2c19671f10d4c527.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1192

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

          Filesize

          101KB

          MD5

          400fc0ac49b8644c08148b7d72ec6089

          SHA1

          cb58a6daf228f9a47a9590d95ff5a20cb4ec6295

          SHA256

          f6fce6a511c0812c0229eb20516de09a9ad69d1fdd7a90cbcf294e4a86439f3f

          SHA512

          a0c3e42b48b4851e8c09ad1ebde36c98a7ca2aa12cb365c384931abd361228a94fec33fbfa9ab45c081f63c288783a001e2336fc516e7ae82b9274be86f1073f

        • C:\Program Files\7-Zip\7-zip.dll.tmp

          Filesize

          199KB

          MD5

          480a9a2abfbe4ce5acddbca5aefe85c9

          SHA1

          7b60a9db3fdc0ea89b4e65bf0534b044427f507e

          SHA256

          2bcb744ae9314d21c631085a3c2ac0b1bde7d2c66a3627667f7f93beab2bffcd

          SHA512

          e8ba2f52f2158c253c131ba54fc5f6c41e105f976dc744089bd64698aea0f32ed413b90cc03425324ae91748d2a5b958a7e6f4f8c2dfa9934e09e648f8ee466d